Top 10 web hacking techniques of 2025
2026-06-04T08:52:03Z•f0c25c81e7b2cfe361d32fc85e6a89b6572da611db63ec8409ae19caf9b26ab6
CSS exfiltrationHTTP desyncHttpOnly bypassJWT forgerySAMLSignSaboteurTRACETurbo IntruderURL validation bypassWAF bypassWebSocket testingXSS__Host__Secureauthentication bypassblind CSS exfiltrationcookie prefix bypasscookie sandwichnamespace confusionparser discrepanciesportswiggerrace conditions (single-packet attack)request smugglingtiming attacksweb security
What happened
This document is an index of PortSwigger Research publications (2024–2026) highlighting multiple novel web-security techniques and exploit concepts. Notable high‑impact items include: parser‑level SAML inconsistencies enabling full authentication bypasses in Ruby/PHP SAML ecosystems (linked to GitLab Enterprise attacks), HTTP desynchronisation/request‑smuggling research (including TRACE‑assisted exploitation and the “desync endgame” that can enable takeover), cookie‑parser attacks that bypass __Host / __Secure prefixes and HttpOnly protections (cookie sandwich / phantom $Version techniques), a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- f0c25c81e7b2cfe361d32fc85e6a89b6572da611db63ec8409ae19caf9b26ab6
- Enrichment time
- 2026-06-04T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.